Frequently Asked Questions
What is ATT&CK?
Why did MITRE develop ATT&CK?
What are "tactics"?
What are "techniques"?
What are "sub-techniques"?
What are "procedures"?
What are the differences between sub-techniques and procedures?
What technologies does ATT&CK apply to?
How can I use ATT&CK?
How often is ATT&CK updated?
Where does the info in ATT&CK come from?
How can I contribute content to ATT&CK?
Please contact us before spending a lot of time writing up a new technique/group/software since we always have things in the works and don’t want you to duplicate efforts. For any contributions we add, we'll run the final product by you and credit you as a contributor. In particular, we're looking for Mac/Linux contributions.
My "favorite" threat group isn't included in ATT&CK - why?
Are there APIs I can use to access the ATT&CK content?
ATT&CK and Other Models
How does ATT&CK relate to other cyber frameworks and models?
What is the relationship between ATT&CK and the Diamond Model?
What is the relationship between ATT&CK and the Lockheed Martin Cyber Kill Chain®?
How should I reference the name ATT&CK?
Both MITRE ATT&CK™ and ATT&CK™ are trademarks of The MITRE Corporation.
- Your first references in writing must include "MITRE" preceding "ATT&CK™" - but subsequently should just reference "ATT&CK" (no trademark symbol required).
- Example of a first reference: MITRE ATT&CK™ is a curated knowledge base and model for cyber adversary behavior...
- Example of subsequent reference: ATT&CK is useful for understanding security risk against known adversary behavior...
- A headline should always reference "MITRE ATT&CK" together (never only "ATT&CK™").
- Always capitalize "ATT&CK" to distinguish it from the surrounding text.
- Do not modify the trademark, such as through hyphenation or abbreviation. For example, "ATT&CK'd!", "Plan-of-ATT&CK", "ATTK".
- You may not display the ATT&CK trademark in any manner that implies an affiliation with, sponsorship, or endorsement by MITRE, or in a manner that can be reasonably interpreted to suggest third party content represents the views and opinions of MITRE or MITRE personnel, unless those third parties receive express permission from MITRE.
- You may not use ATT&CK in your product names, service names, trademarks, logos, or company names.
Where can I download the MITRE ATT&CK logo?
Can I use ATT&CK in my products and/or services?
Remember, you may never use MITRE ATT&CK, MITRE, or ATT&CK in a way that implies an endorsement of a product or service. MITRE does not endorse those organizations, individuals, etc. leveraging MITRE ATT&CK in their work. The inclusion of MITRE ATT&CK does not imply endorsement or support from MITRE.